# Install from Sources

Instructions below describe compilation from sources on Ubuntu 24.04, which is the preferred build and execution environment for the moment. With small changes, the instruction can be applied to other GNU/Linux distributions.

## Build requirements

- [common requirements](/content/knowledge-base/Install-from-Sources/Requirements/index.html)
- 35-40 GB of free disk space.

|     |     |
| --- | --- |
| `1` | `apt-get install make flex bison gcc g++ libboost-all-dev libssl-dev bc fakeroot dwarves libelf-dev lz4` |

## Compiling the patched Kernel

### Install build dependencies

The easiest way to install all the build dependencies for the Linux kernel is to use information from sources repository.

Make sure that the line **deb-src** is present and uncommented in `/etc/apt/sources.list`

|     |     |
| --- | --- |
| `1` | `deb-src http://archive.ubuntu.com/ubuntu noble main restricted` |

Then all the build dependencies can be simply installed:

|     |     |
| --- | --- |
| `1` | `apt-get update` |
| `2` | `apt-get build-dep linux` |

### Obtain kernel sources

Get Linux kernel with Tempesta-Tech patches.

Version **0.9** (current master):

|     |     |
| --- | --- |
| `1` | `git clone https://github.com/tempesta-tech/linux-6.12.12-tfw.git` |

Release version **0.8**:

|     |     |
| --- | --- |
| `1` | `git clone https://github.com/tempesta-tech/linux-5.10.35-tfw.git` |

Or apply [version 0.9 the patch set](https://github.com/tempesta-tech/tempesta/blob/master/linux-6.12.12.patch) to 6.12.12 kernel sources or [release 0.8 the patch set](https://github.com/tempesta-tech/tempesta/blob/ubuntu-24/0.8.0/linux-5.10.35.patch) to 5.10.35 kernel sources.

### Configure Kernel

Before build Linux Kernel must be configured. Recommended way is to reuse current kernel’s configuration with Tempesta FW-specific changes.

Ensure that the kernel tree is absolutely clean:

|     |     |
| --- | --- |
| `1` | `cd linux-6.12.12-tfw # or linux-5.10.35-tfw` |
| `2` | `make clean && make mrproper` |

Copy current kernel’s configuration:

|     |     |
| --- | --- |
| `1` | `cp /boot/config-$(uname -r) .config` |

#### Use a text editor for the copied `.config`:

to comment the following lines if set to "y" before proceeding:

- `CONFIG_SYSTEM_TRUSTED_KEYRING`
- `CONFIG_SYSTEM_TRUSTED_KEYS`
- `CONFIG_SYSTEM_REVOCATION_LIST`
- `CONFIG_SYSTEM_REVOCATION_KEYS`
- all CONFIG_DEFAULT_SECURITY_* lines

Why:
Vanilla kernels don’t include files like debian/canonical-certs.pem. Leaving these options enabled causes build errors or interactive prompts during module signing.

to manually set all these options to "y":

- `CONFIG_SLUB`
- `CONFIG_HUGETLB_PAGE`
- `CONFIG_SECURITY`
- `CONFIG_SECURITY_NETWORK`
- `CONFIG_SECURITY_TEMPESTA`
- `CONFIG_DEFAULT_SECURITY_TEMPESTA`
- "tempesta" listed first in CONFIG_LSM, e.g.

|     |     |
| --- | --- |
| `1` | `CONFIG_LSM="tempesta,lockdown..."` |

For Linux kernel 5.10.35 and above the following config options should be set "y":

- `CONFIG_SOCK_CGROUP_DATA`
- `CONFIG_NET`
- `CONFIG_CGROUPS`
- `CONFIG_CGROUP_NET_PRIO`

Also, it is better to choose `CONFIG_UNWINDER_ORC` instead of `CONFIG_UNWINDER_FRAME_POINTER` and unset `CONFIG_FRAME_POINTER`, for greater efficiency of some cryptographic functions (it is impossible to use %rbp register for calculations if `CONFIG_FRAME_POINTER` or `CONFIG_UNWINDER_FRAME_POINTER` is set).

For integration of [HTTP tables](https://github.com/tempesta-tech/tempesta/wiki/HTTP-tables) and [WebShield](/content/Bot-Protection/index.html) with `iptables` and `nftables` the following config options should be set as well (Tempesta works without these options):

- `CONFIG_NF_TABLES_IPV4`
- `CONFIG_NF_TABLES_IPV6`
- `CONFIG_NF_TABLES`
- `CONFIG_NF_TABLES_INET`

#### Failover configuration

For [high availability](/content/knowledge-base/Install-from-Sources/High-availability/index.html) setup you need to make the kernel to reboot on any issue preventing it from normal operation.

Set following kernel options:

|     |     |
| --- | --- |
| `01` | `CONFIG_WATCHDOG=y` |
| `02` | `CONFIG_SOFTLOCKUP_DETECTOR=y` |
| `03` | `CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y` |
| `04` | `CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=1` |
| `05` | `CONFIG_HARDLOCKUP_DETECTOR_PERF=y` |
| `06` | `CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y` |
| `07` | `CONFIG_HARDLOCKUP_DETECTOR=y` |
| `08` | `CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y` |
| `09` | `CONFIG_BOOTPARAM_HARDLOCKUP_PANIC_VALUE=1` |
| `10` | `CONFIG_DETECT_HUNG_TASK=y` |

and set `sysctl` values in `/etc/sysctl.conf`:

|     |     |
| --- | --- |
| `1` | `kernel.panic=1` |
| `2` | `kernel.panic_on_oops=1` |
| `3` | `kernel.panic_on_rcu_stall=1` |
| `4` | `vm.panic_on_oom=1` |

These settings will reboot the machine on any hung, software crash, or out of memory event.

### Compile and install Kernel

Traditional way is to compile the kernel and manually install modules and kernel image:

|     |     |
| --- | --- |
| `1` | `make -j$(nproc)` |
| `2` | `make modules_install` |
| `3` | `make install` |

## Compiling Tempesta FW

### Install build dependencies

Install build dependencies by calling the next command:

|     |     |
| --- | --- |
| `1` | `apt-get install build-essential libboost-dev libboost-program-options-dev cmake ninja-build libfmt-dev libspdlog-dev pkgconf` |

### Obtain sources

Get version **0.9** (current master) Tempesta FW from Github repository:

|     |     |
| --- | --- |
| `1` | `git clone https://github.com/tempesta-tech/tempesta` |
| `2` | `cd tempesta` |

or release version **0.8**:

|     |     |
| --- | --- |
| `1` | `git clone --branch release-0.8 https://github.com/tempesta-tech/tempesta.git` |
| `2` | `cd tempesta` |

### Compile Tempesta FW

Tempesta FW is an out-of-tree kernel module. It is recommended to reboot into Tempesta’s patched kernel and install kernel headers before building the module. Simply run `make` to prepare the module:

|     |     |
| --- | --- |
| `1` | `make clean` |
| `2` | `make` |

It is also possible to build the module against target kernel sources directory:

|     |     |
| --- | --- |
| `1` | `make clean` |
| `2` | `make KERNEL=<path-to-kernel>` |

### Regular expressions support

Tempesta FW supports regular expressions for HTTP tables and location matching. To enable regular expression support, install the regex compiler package:

`sudo apt install linux-regex`

Make sure the Tempesta FW APT repository is added before running the installation command. Alternatively, you can build the compiler manually from [this repository](https://github.com/tempesta-tech/linux-regex-module).

## Troubleshooting 5.10.35 kernel

During the lifecycle of Ubuntu, utility `pahole` was updated from version 1.22 to version 1.25. Using the updated version leads to kernel build error with the message:

`load BTF from vmlinux: Invalid argument`.

To avoid it:

check version

`pahole --version`

and if it needed, downgrade it

`apt install pahole=1.22-8`.